{
  "family": "bitter",
  "sample_count": 1,
  "category": "trojan",
  "description": "Trojan:Win32/Bitter refers to malware associated with the **Bitter APT group**, an Advanced Persistent Threat actor operating out of South Asia. They primarily target government, military, and energy organizations in neighboring countries (like Pakistan and China) for espionage and data theft. The 'Bitter' malware family encompasses the custom Remote Access Trojans (RATs) and downloaders used by this group.<br><br><b>Understanding the Bitter APT</b><br>To an end-user, the infection is invisible, often starting with a highly targeted spearphishing email. For a SOC analyst, detecting Bitter malware is a major incident indicating a state-sponsored or highly organized espionage campaign targeting the organization's intellectual property or sensitive communications.<br><br><b>Execution and Espionage Mechanics</b><br>Bitter typically gains initial access via Spearphishing Attachments (`T1566.001`), often exploiting known vulnerabilities (like CVE-2012-0158 or CVE-2017-11882) in Microsoft Office documents (Equation Editor). Upon successful exploitation, it drops a custom downloader that retrieves the secondary payload (often a RAT) from compromised infrastructure. The RAT establishes persistence, usually via Registry Run keys or Startup folders (`T1547.001`), and begins collecting system information, capturing keystrokes, and exfiltrating targeted files to the C2 server.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the long-term, stealthy exfiltration of highly sensitive data. Host-based IoCs include the presence of malicious Office documents in user profiles, unexpected executables in `%AppData%` or `%LocalAppData%`, and registry modifications for persistence. Network IoCs involve outbound connections to known Bitter C2 IP addresses or domains, often using custom protocols or HTTP POST requests to exfiltrate data.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.001",
    "T1203",
    "T1048"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment (Targeted delivery using exploit documents)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1203",
      "name": "Exploitation for Client Execution (Exploiting Office vulnerabilities)",
      "tactic": "Execution"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol (Stealing sensitive data)",
      "tactic": "Exfiltration"
    }
  ],
  "containment_steps": [
    "Immediately isolate the infected endpoint and any other machines that the user recently communicated with.",
    "Analyze the initial spearphishing email to identify the sender, subject, and attachment hash, and block them at the email gateway.",
    "Identify the C2 infrastructure used by the Bitter malware and block all outbound traffic to those IPs/domains.",
    "Perform a comprehensive forensic investigation to determine exactly what files or data were accessed and exfiltrated."
  ],
  "what_to_avoid": [
    "Do not assume the attack is a random, opportunistic infection; APT groups like Bitter are highly targeted and persistent.",
    "Avoid wiping the machine immediately; preserve evidence to understand the scope of the espionage."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}